Splunk Search

Run a generating command over a set of values

burwell
SplunkTrust
SplunkTrust

I have a search that will return a number of search ids.

index=_audit | <various modifications>| table search_id

Example.. I end up with

search_id

1604617764.7885_5E002618-3E1F-491E-88C9-516508A9DB66
1604617764.7886_5E002618-3E1F-491E-88C9-516508A9DB66
1604617764.7887_5E002618-3E1F-491E-88C9-516508A9DB66

Now for each of search_id I want to do a rest call to find out information about the search

For example, for the first search_id I want to call:

| rest services/search/jobs/1604617764.7885_5E002618-3E1F-491E-88C9-516508A9DB66 splunk_server=local

Since | rest is a generating command, I can't figure out how to do this.

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You can use the map command

| map maxsearches=100 search="
  | rest services/search/jobs/$search_id$ splunk_server=local
  | table *
"

 https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/Map

However, there are some runtime and performance limits that will affect how many ids you can run over.

Hope this helps

 

View solution in original post

burwell
SplunkTrust
SplunkTrust

The map command was exactly what I needed. And thanks for the correction of the services command (works with/without first /)

Also, if you have other fields you want to refer to in map use $field$

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can use the map command

| map maxsearches=100 search="
  | rest services/search/jobs/$search_id$ splunk_server=local
  | table *
"

 https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/Map

However, there are some runtime and performance limits that will affect how many ids you can run over.

Hope this helps

 

isoutamo
SplunkTrust
SplunkTrust
Hi
Map is exactly correct command for this kind of task. Small fix to your example “rest /services/...” for someone else who are not so familiar with splunk.
r. Ismo
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...